Building your AI vulnerability harness, Part 1

This article describes a three-layer AI-powered pipeline that filters vulnerability scanner findings to prioritize high-confidence, exploitable issues for developers.

• Layer 1: Multi-scanner agreement increases plausibility by requiring multiple independent scanners to converge on the same finding
• Layer 2: Structural verification checks that functions, files, and data flows described by scanners actually exist in the codebase using abstract syntax trees
• Layer 3: Deployment context analyzes infrastructure-as-code templates to determine if protective controls like AWS WAF rules can prevent exploitation
• Progressive filtering with escalating evidence reduces false positives while maintaining confidence in remaining findings
• AI-generated claims require verification against actual code before human review to prevent hallucinated findings from eroding trust
• Implementation starts with AST indexing, then adds multi-scanner triage, hypothesis generation, infrastructure context, and live verification

The architecture is tool-agnostic and transfers across different scanners, AI providers, and infrastructure stacks, helping teams separate signal from noise in vulnerability detection.